prevent bypassing validation using base64

Currently the underscore validation can be easily bypassed with base64